client access to docker swarm

Question

I have a docker swarm cluster consisting of one manager and one worker node. Then I configured (tls and DOCKER_HOST) a client from my laptop to get access to this cluster.

When I run docker ps I see only containers from the worker node (and not all containers of worker node (!)). For example, from my client:

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                                                                                                                                                                      NAMES
a129d9402aeb        progrium/consul     "/bin/start -rejoi..."   2 weeks ago         Up 22 hours         IP:8300-8302->8300-8302/tcp, IP:8400->8400/tcp, IP:8301-8302->8301-8302/udp, 53/tcp, 53/udp, IP:8500->8500/tcp, IP:8600->8600/udp   hadoop1103/consul-agt2-hadoop 

As well as I run docker ps at worker node:

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                                                                                                                                                        NAMES
4fec7fbf0b00        swarm               "/swarm join --advert"   16 hours ago        Up 16 hours         2375/tcp                                                                                                                                                     join
a129d9402aeb        progrium/consul     "/bin/start -rejoin -"   2 weeks ago         Up 22 hours         0.0.0.0:8300-8302->8300-8302/tcp, 0.0.0.0:8400->8400/tcp, 0.0.0.0:8301-8302->8301-8302/udp, 53/tcp, 53/udp, 0.0.0.0:8500->8500/tcp, 0.0.0.0:8600->8600/udp   consul-agt2-hadoop

So two questions: Why docker ps doesn't show containers from manager machine and not all containers from worker node?

Answer 1

Classic swarm (run as a container) by default hides the swarm management containers from docker ps output. You can show these containers with a docker ps -a command instead.

This behavior may be documented elsewhere, but the one location I've seen the behavior documented is in the api differences docs:

GET "/containers/json"

Containers started from the swarm official image are hidden by default, use all=1 to display them.

The all=1 api syntax is the equivalent of the docker ps -a cli.